As people are discussing the issues witth DDoS attacks and attribution, I’m reminded of how the US Government blamed Russia for a DDoS attack against one of their neighbors, which is more accurately (though very indirectly) blamed on me.
Many years ago I complained in an IRC channel about a small website that ripped off the design of one of my sites. A somewhat shady member of that channel happened to control a sizable botnet (with primarily RU IPs). Yep. You see where this is going. (To be clear, I was venting, and didn’t ask him or anyone else to do anything.)
He thought it would be funny to get a little revenge on my behalf. He aimed his entire botnet at that website, and hit the network with so much traffic that it didn’t take down the target server, instead it saturated the core network gear for the country’s main ISP, knocking most of the country offline for several hours.
By pure coincidence, said small Eastern European country was holding national elections the day I complained about the website, something I didn’t discover until years later.
Even the US Government, with all their resources, can’t always tell the difference between a state-backed attack and a teenager “having fun” with a botnet.